CVE-2026-86719

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.

• CWE-352

• https://github.com/WWBN/AVideo/security/advisories/GHSA-xrp7-6w7g-q7fx
• https://www.vulncheck.com/advisories/wwbn-avideo-customizeuser-cross-site-request-forgery-session-hijacking

Published

Sep 8, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86711electerm before 5.3.15 exposes 40+ main-process functions th…7.4
• CVE-2026-86712SiYuan before 3.8.2 trusts the attacker-writable text/siyuan…8.8
• CVE-2026-86713PX4 Autopilot through 1.17.0 contains a use-after-free vulne…7.1
• CVE-2026-86714PX4 Autopilot through 1.17.0 contains a stack buffer over-re…5.4
• CVE-2026-86716A vulnerability was determined in Cesanta mJS up to 1.26. Af…7.3
• CVE-2026-86718WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.1
• CVE-2026-8672Use of default password vulnerability in syslink software AG…5.1
• CVE-2026-86720WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…8.1
• CVE-2026-86721AVideo through commit c3edcc274c contains an authorization b…7.5
• CVE-2026-86722AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.1
• CVE-2026-86723AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 cont…8.1
• CVE-2026-86724AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…6.5